GitNexus/.github/workflows
Gergo Magyar 8674b2b453 ci: cascade quality gate, centralize change detection, prune scope-parity matrix
Add a `paths-changes` job to ci.yml that runs `dorny/paths-filter@v3`
ONCE per CI run and exposes three outputs to the four reusable
sub-workflows via `with:`:

  - web (e2e gate)
  - shared-resolution (forces full parity matrix)
  - changed-languages (JSON array of language slugs to run parity for)

Tier the four sub-workflows so cheap quality checks gate the expensive
tier. `quality` failure now auto-skips `tests`, `e2e`, and
`scope-parity` via `needs: quality` + `if: needs.quality.result ==
'success'`. The `ci-status` aggregator surfaces the originating failure
first so cascade-skipped downstream results don't produce misleading
secondary errors. The aggregator now also includes `paths-changes` in
its `needs:` so a transient filter API failure surfaces with the
correct error, not a fake "Quality jobs failed".

`shared-resolution` is the OR of six independent signals — any change
that could regress any language's parity forces the full matrix:

  - shared-ingestion   (gitnexus/src/core/ingestion/** minus languages/)
  - shared-types       (gitnexus-shared/**)
  - shared-parser-infra (gitnexus/src/core/tree-sitter/**)
  - shared-test-harness (resolver helpers + gitnexus/test/helpers/**)
  - shared-pipeline    (ci.yml, ci-quality.yml, ci-scope-parity.yml,
                        setup-gitnexus action, discovery script)
  - shared-config      (package.json, package-lock.json, vitest.config,
                        tsconfig)

`predicate-quantifier: 'every'` is required for the shared-ingestion
negation to actually exclude (dorny/paths-filter#184); the other
filters use default OR semantics. Both filter steps carry
`continue-on-error: true` so a transient REST API blip falls back to
the conservative full-battery posture rather than blocking the PR.

In `ci-scope-parity.yml`, the discover job intersects MIGRATED_LANGUAGES
with `changed-languages` using strict equality (`IN(.slug; $changed[])`,
not `inside()` which would substring-match `c` against `cpp`). When
`shared-resolution-changed=true` the full matrix runs. The discover
step validates both its own script output and the caller-supplied
`changed-languages` input as JSON arrays before passing them through
`jq --argjson`, so malformed input fails loud at the discover step
instead of producing `fromJSON('')` matrix crashes downstream. An
empty filtered matrix is handled by `if: needs.discover.outputs.languages != '[]'`
on the parity job; the outer workflow conclusion stays `success`.

`ci-e2e.yml` drops its in-workflow `check-changes` job and consumes the
centralized `web-changed` input.

`save-pr-meta` and `ci-status` switch from `if: always()` to
`if: ${{ !cancelled() }}` so user-initiated workflow cancellation
actually cancels them (actions/runner#491).

Dead backward-compat hyphenated artifact copies in `save-pr-meta`
removed — verified the `ci-report.yml` on main reads only
underscore-named files.

Conservative `'true'` defaults on every input for non-PR callers
(release-candidate.yml, publish.yml via workflow_call): the full
battery still runs on every push to main and every release.

Adds `GITHUB_STEP_SUMMARY` lines in both `paths-changes` and the
scope-parity `discover` step so reviewers and agents can see why a
tier was pruned vs. ran without scraping logs.
2026-05-14 17:27:16 +01:00
..
ci-e2e.yml ci: cascade quality gate, centralize change detection, prune scope-parity matrix 2026-05-14 17:27:16 +01:00
ci-quality.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
ci-report.yml ci: add fork-safe PR autofix pipeline (#1446) 2026-05-09 13:35:04 +01:00
ci-scope-parity.yml ci: cascade quality gate, centralize change detection, prune scope-parity matrix 2026-05-14 17:27:16 +01:00
ci-tests.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
ci.yml ci: cascade quality gate, centralize change detection, prune scope-parity matrix 2026-05-14 17:27:16 +01:00
claude.yml ci(claude): allow Bash in code-review job without interactive approval 2026-05-12 09:07:47 +01:00
codeql.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
dependency-review.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
docker.yml chore(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#1557) 2026-05-14 06:45:14 +01:00
gitleaks.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
pr-autofix-apply.yml chore(deps): bump actions/checkout from 5.0.0 to 6.0.2 (#1459) 2026-05-09 19:26:53 +01:00
pr-autofix-publish.yml feat(autofix): replace inline reviewdog with /autofix ChatOps button (#1458) 2026-05-09 16:32:38 +01:00
pr-autofix.yml fix(security): Pin Docker Node base images, remove runtime package-manager CVE surface, verify Trivy on PRs, and harden Dependabot policy (#1455) 2026-05-09 16:55:31 +01:00
pr-description-check.yml chore(deps): bump actions/github-script from 7.0.1 to 9.0.0 2026-04-15 20:17:08 +00:00
pr-labeler.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
publish.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
release-candidate.yml ci(release): skip rc build on release PRs (#1474) 2026-05-10 09:50:58 +01:00
scorecard.yml chore(deps): bump github/codeql-action from 3.35.3 to 4.35.3 (#1390) 2026-05-07 09:54:17 +01:00
tree-sitter-upgrade-readiness.yml chore(deps): tree-sitter 0.25 upgrade readiness monitor with daily Dependabot (#847) 2026-04-16 09:17:21 +01:00
triage-sweep.yml chore(deps): bump actions/cache from 5.0.4 to 5.0.5 (#840) 2026-04-15 13:36:38 +01:00
trivy.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00
workflow-lint.yml fix(security): Harden CI permissions (#1454) 2026-05-09 17:58:22 +01:00